A “semantic attack” is an attack in which the attacker uses the
computing infrastructure/system in a way that fools the victim into
thinking they are doing something, but are doing something different,
yet the computing infrastructure/system is working exactly as it was
designed to do.
Semantic attacks often involve financial scams, where the attacker is
trying to fool the victim into giving the attacker large sums of money
(e.g., thinking they’re investing in something).
For example, the attacker may try to convince the user that they’re
looking at a trusted website, even if they aren’t.

Semantic attacks are difficult to counter, because they’re exploiting
the correct operation of the computer.
The way to deal with semantic attacks is to help give the human
additional information, so that when “odd” things happen the human
will have more information or a warning will be presented
that something may not be what it appears to be.

One example is URIs that, while legitimate, may fool users into
thinking they have a different meaning.
For example, look at this URI:

http://www.bloomberg.com@www.badguy.com

If a user clicked on that URI, they might think that they’re going
to Bloomberg (who provide financial commodities news), but instead
they’re going to www.badguy.com (and providing the username
www.bloomberg.com, which www.badguy.com will conveniently ignore).
If the badguy.com website then imitated the bloomberg.com site,
a user might be convinced that they’re seeing the real thing
(and make investment decisions based on attacker-controlled
information).
This depends on URIs being used in an unusual way - clickable URIs
can have usernames, but usually don’t.
One solution for this case is for the web browser to detect such unusual
URIs and create a pop-up confirmation widget, saying
“You are about to log into www.badguy.com as user www.bloomberg.com;
do you wish to proceed?”
If the widget allows the user to change these entries, it provides
additional functionality to the user as well as providing protection
against that attack.

Another example is homographs, particularly international homographs.
Certain letters look similar to each other, and these can be exploited
as well.
For example, since 0 (zero) and O (the letter O) look similar to each
other, users may not realize that WWW.BLOOMBERG.COM and WWW.BL00MBERG.COM
are different web addresses.
Other similar-looking letters include 1 (one) and l (lower-case L).
If international characters are allowed, the situation is worse.
For example, many Cyrillic letters look essentially the same as
Roman letters, but the computer will treat them differently.
Currently most systems don’t allow international characters in host names,
but for various good reasons it’s widely agreed that support for them
will be necessary in the future.
One proposed solution has been to diplay letters from different code regions
using different colors - that way,
users get more information visually.
If the users look at URI, they will hopefully notice the strange coloring.
[Gabrilovich 2002]
The page
Phishing - Browser-based Defences
provides another set of possible defenses against this attack.
However, this does show the essence of a semantic attack -
it’s difficult to defend against, precisely because the computers are
working correctly.